Is it possible to have Output Specific Filter or vice versa in Logstash

Elastic Stack Logstash
1

I want to have a filter specific to Kafka output . Want to send messages with specific keywords only to Kafka. For ES output want to send all messages (no filter)

output {

    kafka {

    bootstrap_servers => "localhost:9092"

    topic_id =>'sample'
    codec => json
    }

    elasticsearch {

    hosts => "localhost:9200"

    index =>"filebeat-%{+yyyy}"

    }

  }
2 
output {
if "system" in [tags] {
    kafka {
    bootstrap_servers => "localhost:9092"
    topic_id =>'sample'
    codec => json
    }
}
    elasticsearch {
    hosts => "localhost:9200"
    index =>"filebeat-%{+yyyy}"
    }
  }
3

@ylasri Thanks for reply . I made one entry in dmesg

echo "error hello world" >> /var/log/dmesg

And in Kafka

if "error" in [tags] {
kafka {
}
}

It didn't work. is it [tags] or [messages]

4

if "error" in [tags] this was just an example to illustrate that you can filter events based on your own criteria before sending them to an output.

5

Got it @ylasri .

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.